Ransomware Filtering and Removal Solutions Rio de Janeiro
Crypto-Ransomware Rollback: An Example
Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses poorly prepared for an assault. Multiple generations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with more unnamed newcomers, not only perform encryption of online critical data but also infect any available system protection. Information replicated to the cloud can also be rendered useless. In a poorly designed system, this can render automated restoration impossible and effectively sets the network back to zero.
Recovering programs and data following a ransomware intrusion becomes a race against the clock as the victim fights to stop lateral movement, cleanup the ransomware, and restore business-critical operations. Because crypto-ransomware takes time to replicate throughout a targeted network, assaults are usually launched during nights and weekends, when attacks are likely to take more time to identify. This multiplies the difficulty of promptly assembling and organizing a knowledgeable response team.
Progent offers an assortment of solutions for protecting Rio de Janeiro enterprises from ransomware events. Among these are staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to discover and extinguish day-zero modern malware attacks. Progent also offers the assistance of experienced crypto-ransomware recovery consultants with the skills and commitment to restore a breached environment as rapidly as possible.
Progent's Crypto-Ransomware Recovery Services
Soon after a ransomware event, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the needed keys to decrypt any or all of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to piece back together the critical elements of your Information Technology environment. Absent access to essential system backups, this calls for a broad complement of skill sets, professional project management, and the ability to work non-stop until the task is over.
For twenty years, Progent has made available professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of expertise provides Progent the skills to efficiently ascertain important systems and organize the surviving parts of your computer network system following a crypto-ransomware event and configure them into an operational system.
Progent's security team deploys powerful project management systems to coordinate the sophisticated restoration process. Progent understands the importance of working rapidly and together with a customer's management and IT staff to assign priority to tasks and to put key systems back online as fast as humanly possible.
Customer Case Study: A Successful Crypto-Ransomware Penetration Response
A small business contacted Progent after their network was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean government sponsored criminal gangs, possibly using techniques leaked from the United States National Security Agency. Ryuk attacks specific companies with little tolerance for operational disruption and is one of the most profitable examples of ransomware viruses. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area with about 500 employees. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the attack and were encrypted. The client was pursuing financing for paying the ransom (exceeding $200K) and praying for good luck, but ultimately called Progent.
Progent worked hand in hand the client to rapidly identify and assign priority to the most important elements that needed to be addressed to make it possible to continue company operations:
- Microsoft Active Directory
- Electronic Messaging
- Accounting/MRP
In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then charged ahead with setup and storage recovery on mission critical applications. All Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Data Files) on various desktop computers and laptops in order to recover email data. A not too old offline backup of the customer's accounting/ERP systems made it possible to recover these required programs back available to users. Although major work needed to be completed to recover totally from the Ryuk virus, the most important systems were restored rapidly:
Throughout the following month key milestones in the restoration project were completed in close collaboration between Progent engineers and the customer:
- In-house web applications were returned to operation with no loss of data.
- The MailStore Microsoft Exchange Server exceeding four million historical emails was restored to operations and available for users.
- CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent functional.
- A new Palo Alto 850 security appliance was installed and configured.
- Most of the user PCs were functioning as before the incident.
Conclusion
A likely company-ending disaster was dodged by top-tier professionals, a broad array of technical expertise, and close teamwork. Although in analyzing the event afterwards the ransomware incident detailed here should have been stopped with current security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for data backup and proper patching controls, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's team of experts has extensive experience in ransomware virus blocking, cleanup, and file disaster recovery.
Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Consulting Services in Rio de Janeiro
For ransomware cleanup consulting services in the Rio de Janeiro metro area, phone Progent at
Select Topic: